diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index de8070ec..00000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: codeql
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  schedule:
-    - cron: "0 0 * * 0"  # weekly
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ruby]
-    steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4.37.3
-        with:
-          languages: ${{ matrix.language }}
-      - uses: github/codeql-action/analyze@v4.37.3
diff --git a/.github/workflows/rake.yml b/.github/workflows/rake.yml
index b52b40da..e48ee2a3 100644
--- a/.github/workflows/rake.yml
+++ b/.github/workflows/rake.yml
@@ -39,7 +39,8 @@ jobs:
         working-directory: ruby
         run: |
           pip install regex
-          bundle install --with=jsexec
+          bundle config set --local with jsexec
+          bundle install
 
       - name: RSpec
         working-directory: ruby
diff --git a/Gemfile b/Gemfile
index 906c6f5c..371cb18d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -5,7 +5,11 @@ gemspec
 gem "rake", "~> 13.0"
 gem "rspec", "~> 3.13"
 
-gem "interscript-maps", path: "../maps"
+if File.exist?("../maps")
+  gem "interscript-maps", path: "../maps"
+else
+  gem "interscript-maps"
+end
 
 group :secryst do
   if File.exist?("../../secryst")
diff --git a/lib/interscript.rb b/lib/interscript.rb
index cada6920..f023df7c 100644
--- a/lib/interscript.rb
+++ b/lib/interscript.rb
@@ -136,12 +136,13 @@ def rababa_provision(model_name, model_uri)
 
       # Redownload every hour
       if File.exist?(model_path) && File.mtime(model_path) + 3600 >= Time.now
-        model_path
       else
+        # standard:disable Security/Open -- fetches the configured model into the local cache
         data = URI.open(model_uri, encoding: "BINARY").read
+        # standard:enable Security/Open
         File.binwrite(model_path, data)
-        model_path
       end
+      model_path
     end
 
     def map_aliases
diff --git a/lib/interscript/compiler/ruby.rb b/lib/interscript/compiler/ruby.rb
index 5c672dfe..d4ac8889 100644
--- a/lib/interscript/compiler/ruby.rb
+++ b/lib/interscript/compiler/ruby.rb
@@ -1,3 +1,4 @@
+# rubocop:disable Style/GlobalVars, Security/Eval -- map-evaluation context globals; eval runs generated map code
 $main_binding = binding
 
 class Interscript::Compiler::Ruby < Interscript::Compiler
@@ -264,3 +265,4 @@ def self.reset_debug_data
     $map_debug = []
   end
 end
+# rubocop:enable Style/GlobalVars, Security/Eval
diff --git a/lib/interscript/dsl/items.rb b/lib/interscript/dsl/items.rb
index 193f24c7..4764a4b5 100644
--- a/lib/interscript/dsl/items.rb
+++ b/lib/interscript/dsl/items.rb
@@ -1,7 +1,7 @@
 module Interscript::DSL::Items
   include Interscript::DSL::SymbolMM
 
-  def method_missing sym, *args, **kwargs, &block
+  def method_missing sym, *args, **kwargs, &block # standard:disable Style/MissingRespondToMissing -- every method builds a DSL item
     super if args.length > 0
     super if kwargs.length > 0
     super if /[?!=]\z/.match?(sym.to_s)
diff --git a/lib/interscript/dsl/metadata.rb b/lib/interscript/dsl/metadata.rb
index bbcc164d..c0dfe849 100644
--- a/lib/interscript/dsl/metadata.rb
+++ b/lib/interscript/dsl/metadata.rb
@@ -37,6 +37,7 @@ def initialize(yaml: false, map_name: "", library: true, &block)
       when String, Integer, Date
         @node[sym] = stuff.to_s
       when NilClass
+        # nil means the key is intentionally absent
       else
         warn "[#{@map_name}] Metadata key #{sym} expects a String, but #{stuff.class} was given"
         @node[sym] = stuff.inspect
diff --git a/lib/interscript/dsl/symbol_mm.rb b/lib/interscript/dsl/symbol_mm.rb
index 8a851bd1..36d1bd5f 100644
--- a/lib/interscript/dsl/symbol_mm.rb
+++ b/lib/interscript/dsl/symbol_mm.rb
@@ -1,5 +1,5 @@
 module Interscript::DSL::SymbolMM
-  def method_missing sym, *args, **kwargs, &block
+  def method_missing sym, *args, **kwargs, &block # standard:disable Style/MissingRespondToMissing -- every method builds a DSL item
     super if args.length > 0
     super if kwargs.length > 0
     super if /[?!=]\z/.match?(sym.to_s)
diff --git a/lib/interscript/interpreter.rb b/lib/interscript/interpreter.rb
index e1dcc8b1..a1d28c43 100644
--- a/lib/interscript/interpreter.rb
+++ b/lib/interscript/interpreter.rb
@@ -1,3 +1,5 @@
+# rubocop:disable Style/GlobalVars
+# $select_nth_string/$DEBUG_RE/$subs_array are deliberate execution/debug context flags
 class Interscript::Interpreter < Interscript::Compiler
   attr_accessor :map
   def compile(map, _: nil)
@@ -48,7 +50,7 @@ def call(str, stage = :main, each: false, &block)
             options_set = true
 
             opts = options.map { |i| (0...i).to_a }
-            choices = opts[0].product(*opts[1..-1])
+            choices = opts[0].product(*opts[1..])
           end
 
           yielder.yield(result)
@@ -252,3 +254,4 @@ def build_item i, target = nil, doc = @map
     end
   end
 end
+# rubocop:enable Style/GlobalVars
diff --git a/lib/interscript/node/item.rb b/lib/interscript/node/item.rb
index 7584620d..2456655f 100644
--- a/lib/interscript/node/item.rb
+++ b/lib/interscript/node/item.rb
@@ -23,7 +23,7 @@ def + other
 
       middle = [this.last + other.first]
       this = this[0..-2]
-      other = this[1..-1]
+      other = this[1..]
     end
 
     g = Interscript::Node::Item::Group.new(*this, *middle, *other)
@@ -41,7 +41,7 @@ def ==(other)
   end
 
   def self.try_convert(i)
-    i = Interscript::Node::Item::String.new(i) if i.class == ::String
+    i = Interscript::Node::Item::String.new(i) if i.instance_of?(::String)
     raise Interscript::MapLogicError, "Wrong type #{i.class}, expected I::Node::Item" unless Interscript::Node::Item === i
     i
   end
diff --git a/lib/interscript/node/item/alias.rb b/lib/interscript/node/item/alias.rb
index 19bc4706..79f3914f 100644
--- a/lib/interscript/node/item/alias.rb
+++ b/lib/interscript/node/item/alias.rb
@@ -52,7 +52,7 @@ def inspect
     if map
       "map.#{map}.#{name}"
     else
-      "#{name}"
+      name.to_s
     end
   end
 end
diff --git a/lib/interscript/node/item/any.rb b/lib/interscript/node/item/any.rb
index cf138247..f09c42eb 100644
--- a/lib/interscript/node/item/any.rb
+++ b/lib/interscript/node/item/any.rb
@@ -19,7 +19,7 @@ def data
     when Array
       value.map { |i| Interscript::Node::Item.try_convert(i) }
     when ::String
-      value.split("").map { |i| Interscript::Node::Item.try_convert(i) }
+      value.chars.map { |i| Interscript::Node::Item.try_convert(i) }
     when Range
       value.map { |i| Interscript::Node::Item.try_convert(i) }
     end
@@ -45,7 +45,7 @@ def first_string
   end
 
   def nth_string
-    return first_string unless $select_nth_string
+    return first_string unless $select_nth_string # standard:disable Style/GlobalVars
 
     d = data
     Fiber.yield(:prepare)
diff --git a/lib/interscript/node/item/group.rb b/lib/interscript/node/item/group.rb
index d0a62bac..b4af792c 100644
--- a/lib/interscript/node/item/group.rb
+++ b/lib/interscript/node/item/group.rb
@@ -49,7 +49,7 @@ def verify!
     wrong = @children.find do |i|
       Interscript::Node::Item::Stage === i ||
         !(Interscript::Node::Item === i) ||
-        i.class == Interscript::Node::Item
+        i.instance_of?(Interscript::Node::Item)
     end
 
     if wrong
diff --git a/lib/interscript/node/rule/sub.rb b/lib/interscript/node/rule/sub.rb
index 8fb5a46c..c368de8a 100644
--- a/lib/interscript/node/rule/sub.rb
+++ b/lib/interscript/node/rule/sub.rb
@@ -114,7 +114,7 @@ def reverse_transfer from, to
         to = out.compact
 
         from = from.dup.tap do |i|
-          i.children = i.children[1..-1]
+          i.children = i.children[1..]
         end.compact
       end
 
diff --git a/lib/interscript/node/stage.rb b/lib/interscript/node/stage.rb
index fe417f79..bea1856c 100644
--- a/lib/interscript/node/stage.rb
+++ b/lib/interscript/node/stage.rb
@@ -33,7 +33,7 @@ def ==(other)
 
   def inspect
     args = []
-    args << "#{@name}" if @name != :main
+    args << @name.to_s if @name != :main
     args << "dont_reverse: true" if dont_reverse
     name = ""
     name = "(#{args.join(", ")})" unless args.empty?
diff --git a/lib/interscript/stdlib.rb b/lib/interscript/stdlib.rb
index 60812946..b1210a43 100644
--- a/lib/interscript/stdlib.rb
+++ b/lib/interscript/stdlib.rb
@@ -41,15 +41,15 @@ def self.parallel_regexp_gsub(string, subs_regexp, subs_hash)
     string.gsub(subs_regexp) do |match|
       lm = Regexp.last_match
       # Extract the match name
-      idx = lm.named_captures.compact.keys.first[1..-1].to_i
+      idx = lm.named_captures.compact.keys.first[1..].to_i
       subs_hash[idx]
     end
   end
 
   def self.parallel_regexp_gsub_debug(string, subs_regexp, subs_array)
     # only gathering debug info, test data is available in maps_analyze_staging
-    $subs_matches = []
-    $subs_regexp = subs_regexp
+    $subs_matches = [] # standard:disable Style/GlobalVars
+    $subs_regexp = subs_regexp # standard:disable Style/GlobalVars
     # $subs_array = subs_array
     string.gsub(subs_regexp) do |match|
       lm = Regexp.last_match
@@ -58,9 +58,9 @@ def self.parallel_regexp_gsub_debug(string, subs_regexp, subs_array)
       matched = lm.named_captures.compact.keys.first
       # puts matched.inspect
       # puts [lm.begin(matched), lm.end(matched)].inspect
-      idx = matched[1..-1].to_i
+      idx = matched[1..].to_i
       debug_info = {begin: lm.begin(matched), end: lm.end(matched), idx: idx, result: subs_array[idx]}
-      $subs_matches << debug_info
+      $subs_matches << debug_info # standard:disable Style/GlobalVars
       subs_array[idx]
     end
   end
@@ -104,7 +104,7 @@ def self.parallel_replace_compile_tree(hash)
         from = Array(from)
         from.each do |f|
           branch = tree
-          chars = f.split("")
+          chars = f.chars
           chars[0..-2].each do |c|
             branch[c.ord] ||= {}
             branch = branch[c.ord]
@@ -214,7 +214,7 @@ def self.decompose(output, _: nil)
     end
 
     def self.separate(output, separator: " ")
-      output.split("").join(separator)
+      output.chars.join(separator)
     end
 
     def self.unseparate(output, separator: " ")
diff --git a/lib/interscript/utils/helpers.rb b/lib/interscript/utils/helpers.rb
index 6de26861..9c9c3476 100644
--- a/lib/interscript/utils/helpers.rb
+++ b/lib/interscript/utils/helpers.rb
@@ -1,3 +1,5 @@
+# rubocop:disable Style/GlobalVars
+# spec-support globals; deliberate process-level state
 module Interscript::Utils
   module Helpers
     def document name = nil, &block
@@ -37,3 +39,4 @@ def parse(map_name, **kwargs)
     end
   end
 end
+# rubocop:enable Style/GlobalVars
diff --git a/lib/interscript/utils/regexp_converter.rb b/lib/interscript/utils/regexp_converter.rb
index e3db612c..76e11fcd 100644
--- a/lib/interscript/utils/regexp_converter.rb
+++ b/lib/interscript/utils/regexp_converter.rb
@@ -63,7 +63,7 @@ def process(node)
     out = [:missing, node.class]
 
     out << children if node.respond_to? :expressions
-    if node.respond_to? :quantifier and node.quantifier
+    if node.respond_to?(:quantifier) && node.quantifier
       # TODO add quantifier support
       pp node
       # out << process(node.quantifier)
@@ -82,7 +82,7 @@ def process(node)
 def process_root(node)
   node2 = node.dup
   root = {}
-  if before = node.select { |x| x[0] == :lookbehind_start }
+  if (before = node.select { |x| x[0] == :lookbehind_start })
     # root[:before] = before[1]
     # node2.delete(before)
     if before.size == 1
@@ -100,7 +100,7 @@ def process_root(node)
     end
 
   end
-  if not_before = node.select { |x| x[0] == :negative_lookbehind_start }
+  if (not_before = node.select { |x| x[0] == :negative_lookbehind_start })
     # root[:not_before] = not_before[1]
     # node2.delete(not_before)
 
@@ -118,7 +118,7 @@ def process_root(node)
       not_before.each { |n| node2.delete(n) }
     end
   end
-  if after = node.select { |x| x[0] == :lookahead_start }
+  if (after = node.select { |x| x[0] == :lookahead_start })
     # root[:after] = after[1]
     # node2.delete(after)
 
@@ -137,7 +137,7 @@ def process_root(node)
     end
 
   end
-  if not_after = node.select { |x| x[0] == :negative_lookahead_start }
+  if (not_after = node.select { |x| x[0] == :negative_lookahead_start })
     # root[:not_after] = not_after[1]
     # node2.delete(not_after)
     if not_after.size == 1
@@ -207,12 +207,12 @@ def stringify(node)
     # if prev==:range_stop and token==:range_start
     #  str << ' :adding_ranges '
     # end
-    if (prev.instance_of?(String) && right_side.include?(token)) or
-        (left_side.include?(prev) && token.instance_of?(String)) or
+    if (prev.instance_of?(String) && right_side.include?(token)) ||
+        (left_side.include?(prev) && token.instance_of?(String)) ||
         (left_side.include?(prev) && right_side.include?(token))
       str << " + "
     end
-    str << ", " if prev == :alternative_stop and token == :alternative_start
+    str << ", " if (prev == :alternative_stop) && (token == :alternative_start)
     # str << '[' if prev == :characterset_start and token == :range_start
     # str << ']' if prev == :range_stop and token ==:characterset_stop
     if subs.include? token
diff --git a/lib/interscript/visualize/json.rb b/lib/interscript/visualize/json.rb
index 9b364de9..a6b55720 100644
--- a/lib/interscript/visualize/json.rb
+++ b/lib/interscript/visualize/json.rb
@@ -35,13 +35,12 @@ def to_visualization_array(map = self)
           more: more.join(", ")
         }
       when Interscript::Node::Rule::Run
-        if rule.stage.map
-          doc = map.dep_aliases[rule.stage.map].document
-          stage = rule.stage.name
+        doc = if rule.stage.map
+          map.dep_aliases[rule.stage.map].document
         else
-          doc = map
-          stage = rule.stage.name
+          map
         end
+        stage = rule.stage.name
 
         more = []
         more << "<nobr>reverse run:</nobr> #{rule.reverse_run}" unless rule.reverse_run.nil?
diff --git a/lib/interscript/visualize/nodes.rb b/lib/interscript/visualize/nodes.rb
index 6aa1af8b..ae356a55 100644
--- a/lib/interscript/visualize/nodes.rb
+++ b/lib/interscript/visualize/nodes.rb
@@ -5,7 +5,7 @@ def to_html(doc)
         n = doc.dep_aliases[map].full_name
         "#{name.to_s.tr("_", " ")} from map #{n}"
       else
-        "#{name.to_s.tr("_", " ")}"
+        name.to_s.tr("_", " ").to_s
       end
     end
   end
@@ -16,7 +16,7 @@ def to_html(doc)
         n = doc.dep_aliases[map].full_name
         "stage #{name.to_s.tr("_", " ")} from map #{n}"
       else
-        "#{name.to_s.tr("_", " ")}"
+        name.to_s.tr("_", " ").to_s
       end
     end
   end
@@ -28,7 +28,7 @@ def to_html(doc)
         when Array
           value.map(&Interscript::Node::Item.method(:try_convert)).map { |i| i.to_html(doc) }.join(", ")
         when ::String
-          value.split("").map(&Interscript::Node::Item.method(:try_convert)).map { |i| i.to_html(doc) }.join(", ")
+          value.chars.map(&Interscript::Node::Item.method(:try_convert)).map { |i| i.to_html(doc) }.join(", ")
         when Range
           [value.begin, value.end].map(&Interscript::Node::Item.method(:try_convert)).map { |i| i.to_html(doc) }.join(" to ")
         else